General
-
Target
15e66fb87e224e9bc397dc5cf64890f5_JaffaCakes118
-
Size
490KB
-
Sample
241005-dhl6la1gpj
-
MD5
15e66fb87e224e9bc397dc5cf64890f5
-
SHA1
fc72f39c937153840ace86e2c2f0db0e372fd812
-
SHA256
a41ad4f52987447c2c9a0cebfe0e12f632b40ce22364ed95bb11aed10b28c11a
-
SHA512
7bc116dc8c91cf52c52d0ce1ef4a32cc26adfb2abf2950ea5ea2520eac0f558c0b7c92a1d9ce22d9ee1fb01b1d8ad55742ce552f1e4b689ab77f0c86231f7247
-
SSDEEP
12288:bWHBIZKzL7kioF9aDB7dX2BTJMM4mNkhvoa/x:bY72C9AYykhvoap
Malware Config
Targets
-
-
Target
15e66fb87e224e9bc397dc5cf64890f5_JaffaCakes118
-
Size
490KB
-
MD5
15e66fb87e224e9bc397dc5cf64890f5
-
SHA1
fc72f39c937153840ace86e2c2f0db0e372fd812
-
SHA256
a41ad4f52987447c2c9a0cebfe0e12f632b40ce22364ed95bb11aed10b28c11a
-
SHA512
7bc116dc8c91cf52c52d0ce1ef4a32cc26adfb2abf2950ea5ea2520eac0f558c0b7c92a1d9ce22d9ee1fb01b1d8ad55742ce552f1e4b689ab77f0c86231f7247
-
SSDEEP
12288:bWHBIZKzL7kioF9aDB7dX2BTJMM4mNkhvoa/x:bY72C9AYykhvoap
Score10/10-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-